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AMENDMENT TO THE CLAIMS 

The following is a complete and revised listing of the claims, marked with status 
identifiers in parentheses, underlines indicating insertions, and strikethroughs or double 
brackets indicating deletions. This listing is to replace all prior listing of the claims. 

1. - 7. (Cancelled) 

8. (New) A method for transmitting data between a fail safe computer and a 
plurality of input/output modules via a bus control unit, said bus control unit being 
connected to said plurality of input/output modules via a serial bus and being connected 
to the fail safe computer, comprising cyclically carrying out following steps: 

transmitting, via the bus control unit, a first address over the serial bus for 
addressing one of the input/output modules; 

transmitting, via the bus control unit, a first multi-bit message over the serial bus 
to the input/output module addressed by the first address, the first multi-bit message 
including at least one first check bit and at least one first load bit; 

receiving, at the input/output module addressed by the first address, the first 
multi-bit message; and 

accepting, at the input/output module addressed by said first address, the first 
multi-bit message as correct only if the at least one first check bit is different from a 
corresponding first check bit included in a previous first multi-bit message received by 
the input/output module when addressed by the first address. 
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9. (New) A method according to claim 8, wherein the addressed input/output 
module additionally executes, the steps of: 

resetting a timer belonging to the addressed input/output module, if and only if 
said at least first one check bit is different from the corresponding first check bit included 
in the previous first multi-bit message received by this input/output module when 
addressed by the first address, 

switching an output of the addressed input/output module to a secure condition 
when said timer has run out; and 

determining a state of the output according to the at least one first load bit as 
long as the timer has not run out. 

10. (New) A method according to claim 8, further comprising the steps of: 
transmitting, via the bus control unit, a second address over the serial bus for 

addressing the input/output module already addressed by the first address also by the 
second address; 

transmitting, via the bus control unit, a second multi-bit message over the serial 
bus to the input/output module addressed by the second address, the second multi-bit 
message including at least one second check bit and at least one second load bit; 

receiving, at the input/output module addressed by the second address, the 
second multi-bit message; and 

accepting, at the input/output module addressed by the second address, the 
second multi-bit message as correct only if the at least one second check bit is different 
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from a corresponding second check bit included in a previous second multi-bit message 
transmitted to the input/output module when addressed by the second address. 

1 1 . (New) A method according to claim 10, further comprising the steps of: 
comparing, at the input/output module addressed by the first and second 

addresses, the first and second multi-bit messages; and 

accepting, at the input/output module addressed by the first and second 
addresses, the first and second multi-bit messages as correct only if said first and 
second multi-bit messages correspond to each other. 

12. (New) A method according to claim 8, wherein the number of first load bits 
is at least four. 

13. (New) A method according to claim 9, wherein the number of first load bits 
is at least four. 

14. (New) A method according to claim 10, wherein the number of first load bits 
is at least four. 

15. (New) A method according to claim 1 1 , wherein the number of first load bits 
is at least four. 
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